MASQUE and CONNECT-UDP

MASQUE uses HTTP/3 extended CONNECT to proxy UDP datagrams through an authorized intermediary.

Treat a MASQUE tunnel as a privileged network capability: authenticate the client, restrict destinations and ports, cap bandwidth and lifetime, and prevent access to loopback, metadata, and private networks.

httpprotocolhttp3masqueproxysecurity

Reference (http)

CONNECT target.example:443 HTTP/3
Capsule-Protocol: ?1
Datagram-Flow-Id: 0

Common mistakes

Allowing arbitrary destinations, trusting a client-supplied authority, or forgetting that a tunnel can bypass ordinary HTTP egress filters.

HTTP/3 and QUIC Controls Server-Side Request Forgery (SSRF) Defense Proxies, Gateways, and Forwarded Headers

Sources

MDN HTTP Reference
OWASP HTTP Headers Cheat Sheet
RFC 9298: HTTP Datagrams and CONNECT-UDP
RFC 9484: CONNECT-IP